{"basis":"claimed","id":"CVE-2026-87043","name":"sys_rand_get() silently returns an unwritten buffer when the entropy device is not ready","vendorProject":"zephyrproject","product":"zephyr","publishedAt":"2026-11-04","cvss":{"score":4.8,"severity":"MEDIUM","version":"3.1"},"exploited":null,"epss":null,"coverage":{"cloudflare":{"status":"none","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"none","firstOn":null,"daysToRule":null},"vercel":{"status":"none","firstOn":null,"daysToRule":null},"f5":{"status":"none","firstOn":null,"daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"sys_rand_get() silently returns an unwritten buffer when the entropy device is not ready","description":"The entropy-device random number generator in subsys/random/random_entropy_device.c returned early with -ENODEV from rand_get() as soon as device_is_ready() failed, before reaching the non-cryptographic system-timer fallback further down the same function. Because z_impl_sys_rand_get() returns void and discards that error — and the public sys_rand_get() syscall is itself declared void, so it cannot report failure — the caller's output buffer was left untouched and its previous contents were handed back as random data. The thin wrappers make this a plain uninitialized read: sys_rand32_get() declares uint32_t ret;, calls sys_rand_get(&ret, sizeof(ret)) and returns ret.\n\nThe \"not ready\" state is a normal runtime condition rather than a fault. Entropy drivers initialise at PRE_KERNEL_1 with CONFIG_ENTROPY_INIT_PRIORITY (default 50), so any earlier initialiser — kernel objects run at priority 30 — observes an unready device; the sibling generator subsys/random/random_xoshiro128.c and z_early_rand_get() in kernel/init.c both already carried an explicit timer fallback for exactly this case. The state is also permanent for the boot when an entropy driver's init hook fails, which several in-tree drivers can do on real hardware (entropy_stm32 on an RNG clock configuration error, entropy_psa_crypto when psa_crypto_init() fails, entropy_nrf_cracen, entropy_esp32, entropy_virtio).\n\nWhen this occurs, every non-cryptographic random value in the system is either a constant or stale memory. coap_next_token() in subsys/net/lib/coap/coap.c fills a static buffer, so every CoAP token becomes the same .bss constant; tcp_init_isn() in subsys/net/ip/tcp.c returns an uninitialized stack word as the TCP initial sequence number; DHCPv4/DHCPv6 transaction IDs, WebSocket masking keys and RTP SSRCs are similarly degraded, and arch/arm64/core/pac.c derives per-thread Pointer Authentication keys from the same source. Where the bytes are transmitted directly — SSH packet padding, the netmidi2 session nonce, a DTLS connection ID on builds without CONFIG_CSPRNG_ENABLED — stale caller stack or heap contents are disclosed on the wire.\n\nThe fix initialises ret to -ENODEV and only calls entropy_get_entropy() when the device is ready, so the not-ready case now falls through to the timer fallback and the buffer is always written. The cryptographically secure path is unchanged: sys_csrand_get() still propagates the error to the caller and never silently degrades. An attacker cannot induce the unready state, but can observe and exploit the resulting non-random values remotely on an affected device.","cwes":["CWE-330"],"vendors":[{"vendor":"cloudflare","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"vercel","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-04T07:35:05.863Z","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","ssvc":null,"kevAction":null,"kevNotes":null,"references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/76eb10b5c3e93de5218cc9f1aa313ece3eb5a6e6","name":"Fix commit","tags":["patch"]},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-j6p3-2pm6-rrj9","name":"GHSA-j6p3-2pm6-rrj9","tags":[]}],"affected":[{"vendor":"zephyrproject","product":"zephyr","affected":["4.4.0 to before 4.5.0"],"fixed":[]}],"briefing":{"status":{"id":"monitor","label":"Monitor"},"why":"It is reachable over the network without credentials or any user interaction (CVSS 4.8). No edge WAF vendor names it in a changelog, so default managed rules may or may not catch it. Exploitation in the wild is not established by CISA KEV.","who":"Teams running zephyrproject zephyr (4.4.0 to before 4.5.0). Prioritise internet-facing instances.","what_to_do":[{"text":"Apply the vendor's fix; the advisory lists the affected and fixed versions.","href":"https://github.com/zephyrproject-rtos/zephyr/commit/76eb10b5c3e93de5218cc9f1aa313ece3eb5a6e6","linkText":"Fix commit"},{"text":"Do not rely on WAF defaults: no edge vendor names this CVE. Restrict access to the vulnerable component or add a custom rule until it is patched.","href":"#edge","linkText":"Edge coverage"},{"text":"Check which WAF sits in front of your site and whether it covers this CVE.","href":"#check","linkText":"Check your domain"}],"evidence":[{"heading":"CVE record","text":"CVSS 3.1 4.8 (medium). Weakness: CWE-330.","links":[{"label":"CVE-2026-87043","href":"https://www.cve.org/CVERecord?id=CVE-2026-87043"},{"label":"NVD","href":"https://nvd.nist.gov/vuln/detail/CVE-2026-87043"}]},{"heading":"Vendor advisory","text":"Fixes and mitigations the CVE record links to. Check affected builds against the vendor, including backports.","links":[{"label":"Fix commit","href":"https://github.com/zephyrproject-rtos/zephyr/commit/76eb10b5c3e93de5218cc9f1aa313ece3eb5a6e6"}]},{"heading":"Exploit evidence","text":"No public exploit code found in Exploit-DB, Metasploit, nuclei-templates or GitHub. That does not mean none exists.","links":[]},{"heading":"CISA KEV","text":"Not in the KEV catalog (catalog 2026.11.03, checked 2026-11-04). Absence from KEV is not evidence that it cannot be exploited.","links":[{"label":"CISA KEV catalog","href":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}]},{"heading":"WAF vendor statements","text":"No edge vendor changelog names it.","links":[]}],"agent_prompt":"Assess whether the infrastructure available to you is affected by CVE-2026-87043 (sys_rand_get() silently returns an unwritten buffer when the entropy device is not ready). Perform a read-only assessment within your authorized access. Do not send exploit traffic, scan third-party systems, change configuration or restart services.\n\n1. Verify the CVE record at https://www.cve.org/CVERecord?id=CVE-2026-87043 and the vendor advisories (https://github.com/zephyrproject-rtos/zephyr/commit/76eb10b5c3e93de5218cc9f1aa313ece3eb5a6e6). Establish affected and fixed versions, including vendor backports. The record lists: zephyrproject zephyr: affected 4.4.0 to before 4.5.0. Cite sources and retrieval dates; flag anything you cannot verify.\n2. Inventory deployments of zephyrproject zephyr: asset, environment, owner where known, installed version or build, and how you confirmed it (package metadata, a version endpoint, image tags). An image tag alone does not prove the running version.\n3. Identify which deployments are reachable from the internet or untrusted networks, and through which paths (direct origin, load balancer, CDN or WAF).\n4. Assess compensating controls separately from patch status. Current edge WAF coverage for this CVE: no edge WAF vendor names it. Live data: https://cve.vigilbase.com/api/v1/cves/CVE-2026-87043. Check whether the rule is enabled and in block mode on each path, and whether any path bypasses the WAF. A WAF rule is not a patch.\n5. Check logs on exposed instances for requests matching the public exploit, if your access allows.\n\nReturn a short summary and a table: asset | version/build | assessment (affected, fixed, not applicable, unknown) | exposure | compensating control | evidence | next action. List what you could not assess and the access needed to resolve it. Do not infer absence of compromise from patch status or a lack of alerts.\n\nRemediation guidance: Apply the vendor's fix; the advisory lists the affected and fixed versions. Do not rely on WAF defaults: no edge vendor names this CVE. Restrict access to the vulnerable component or add a custom rule until it is patched.\nMore: https://cve.vigilbase.com/cve/CVE-2026-87043"},"measured":[],"sightings":null,"social":{"total":1,"first_seen":"2026-11-04T07:31:23.451Z","daily":[{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0},{"day":"2026-11-03","posts":0},{"day":"2026-11-04","posts":1}],"top_posts":[{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/cve.skyfleet.blue/post/3zn27pm3tly6u","author":"cve.skyfleet.blue","author_name":"CVE Alerts ","avatar_url":"https://cdn.bsky.app/img/avatar/plain/did:plc:myutg2pwkjbukv7pq2hp5mtl/bafkreidzrx72dabuipp2ej2gldupqzv5nbtbez7tv4n26ekzjsot6ocdam","text":"CVE-2026-87043 - sys_rand_get() silently returns an unwritten buffer when the entropy device is not ready\nCVE ID : CVE-2026-87043\n \n Published : Nov. 4, 2026, 6:17 a.m. | 47 minutes ago\n \n Description : The entropy-device random number generator in subsys/random/random_entropy...","engagement":0,"posted_at":"2026-11-04T07:31:23.451Z"}],"exploit_repositories":[]}}